Skip to content

Allow throwing an access denied exception on denormalization of secured properties #7221

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Jun 20, 2025

Conversation

dwgebler
Copy link
Contributor

Throw AccessDeniedException when security conditions for an operation or property aren't met on denormalize

Q A
Branch? main
Tickets Closes #7198
License MIT
Doc PR api-platform/docs#2170

Supports adding throw_on_access_denied (bool) as a value in extra_properties on an Operation or ApiProperty so that during denormalization, if any security condition is not met an AccessDeniedException is thrown instead of silently reverting the property to its previous value.

throw AccessDeniedException when security conditions for an operation or
property aren't met on denormalize
@dwgebler
Copy link
Contributor Author

Not sure what the reason is for failure:

PHPUnit\Framework\Exception: Class "ApiPlatform\Symfony\Security\Exception\AccessDeniedException" does not exist

Relevant tests pass locally and this class does exist in branch and main? https://github.com/api-platform/core/blob/main/src/Symfony/Security/Exception/AccessDeniedException.php

@soyuka
Copy link
Member

soyuka commented Jun 19, 2025

Amazing contribution! Do you think that we can use ApiPlatform\Metadata\Exception\AccessDeniedException ? Indeed I'm trying to get rid of the Symfony\Exception namespace as its not compatible with Laravel.

@dwgebler
Copy link
Contributor Author

Amazing contribution! Do you think that we can use ApiPlatform\Metadata\Exception\AccessDeniedException ? Indeed I'm trying to get rid of the Symfony\Exception namespace as its not compatible with Laravel.

Ah @soyuka I see - because it's a new feature, I based my branch off main but the new AccessDeniedException in the Metadata namespace is only in 4.1 branch. What should I do here? Rebase to 4.1 or will the changes there be merged into main soon?

@soyuka
Copy link
Member

soyuka commented Jun 20, 2025

It should be available on the main branch already, indeed you can rebase against main if you don't have the changes locally.

@dwgebler
Copy link
Contributor Author

It should be available on the main branch already, indeed you can rebase against main if you don't have the changes locally.

@soyuka yeah it is now, it wasn't when I first did the branch but after syncing my fork and updating, looks all good. I've added some lint fixes and updated another serializer test where this code change means prophecy needed an extra expectation, you have a few other CI failures on this PR; they don't appear related to me, but have a look at it again and let me know if anything else needs changing.

@soyuka soyuka merged commit 1290ebb into api-platform:main Jun 20, 2025
101 of 112 checks passed
@soyuka
Copy link
Member

soyuka commented Jun 20, 2025

Tyvm @dwgebler I'll soon release an alpha version of API Platform 4.2!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Allow config option to throw 403 when securityPostDenormalize fails for an API property
2 participants